CVE-2026-66003
Frappe: Access control bypass via REST API dot-notation fields on linked doctypes
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link field, the framework does not consistently enforce the linked DocType's own permissions when the record is retrieved through the REST API, so a low-privileged authenticated user can obtain fields from linked records outside their permitted scope. This issue is fixed in version 15.115.0.
| CWE | CWE-863 |
| Vendor | frappe |
| Product | frappe |
| Published | Aug 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for frappe frappe
Be the first to know when new unknown vulnerabilities affecting frappe frappe are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
frappe / frappe
< 15.115.0